Added
- A vault for SSH keys, hosts and files, encrypted in your browser before it's saved. The server only ever holds ciphertext.
- Login with a password, then three questions you wrote, answered one at a time. Each answer is part of the key.
- Wrong answers pause unlocking for longer each time, and enough of them freeze the account.
- Generate ed25519 or RSA keys in the browser, or paste in ones you already have.
- An install script that puts your keys and hosts in
~/.ssh/tuck/and adds oneIncludeline to your ssh config. Running it again updates the machine, and--removeundoes it. It skips risky ssh options and tells you what it left out. - Warnings when the server hands back an old copy of an item or file, something you deleted, an older copy of the whole vault, or an empty vault this browser has seen things in. Anything out of date is hidden.
- An optional front door: with
TUCK_GATE_PASSWORDset, visitors see only a word (TUCK_GATE_WORD) until they type the password. - The vault locks after two quiet minutes, leaving the tab logs you out, and copied secrets are cleared from the clipboard after 30 seconds.
- A decrypted JSON export for your own backups.
- A Docker image for amd64 and arm64, with a bundled Postgres that has no network, or your own Postgres over TLS.
- An audit log of logins, unlocks and wrong answers.
- A landing page at tuck.dimwit.me and documentation at docs.tuck.dimwit.me.
Image
ghcr.io/dimwitlabs/tuck:1.0.0@sha256:1b978d82195a4a1734241cf6642901e9e0ec568b0a9c98d913a4f00b1e675723